Disable REST API endpoints for internal post types

[obenland]

Fixes #

Proposed changes:

• Disable REST API access for internal custom post types (ap_inbox, ap_outbox, ap_post) by setting 'show_in_rest' to false

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Disable REST API endpoints for internal post types.

[Copilot]

Pull Request Overview

This PR addresses a security/privacy concern by disabling REST API access for internal ActivityPub post types that should not be publicly accessible through WordPress's REST API.

Key Changes:

• Modified three custom post type registrations (ap_inbox, ap_outbox, ap_post) to set 'show_in_rest' from true to false
• Added changelog entry documenting this fix

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
includes/class-post-types.php	Disabled REST API exposure for three internal post types by setting 'show_in_rest' to false
.github/changelog/2463-from-description	Added changelog entry documenting the fix

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.